Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-07-2024 08:01
Static task
static1
Behavioral task
behavioral1
Sample
ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe
Resource
win10v2004-20240508-en
General
-
Target
ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe
-
Size
5.9MB
-
MD5
048aee0544f6faf502419b571a053980
-
SHA1
047c0fb760c3af3b0a1e741bd808858090dd70bf
-
SHA256
ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f
-
SHA512
4fa292dade05bfc568ba6a39f129bdf88e59486faadebd64f2488fac79893c49b95c1bd7a606afae5e2add7cfece62554aa6d0e5ebd9f4eb75ba20dd462e8940
-
SSDEEP
98304:jYBYLosS6pvT7gIit3r648uaK9hobG/c70C0LRaFS:cBYLNS6pvT76t3r6bJK9hobZEVp
Malware Config
Extracted
vidar
https://t.me/bu77un
https://steamcommunity.com/profiles/76561199730044335
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4564-68-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/4564-66-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/4564-72-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/4564-86-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 behavioral2/memory/4564-164-0x0000000000400000-0x0000000000648000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
JEGHJDGIJE.exeAAAKEBGDAF.exepid process 1788 JEGHJDGIJE.exe 4364 AAAKEBGDAF.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exeJEGHJDGIJE.exeAAAKEBGDAF.exedescription pid process target process PID 1124 set thread context of 4564 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1788 set thread context of 1940 1788 JEGHJDGIJE.exe RegAsm.exe PID 4364 set thread context of 1888 4364 AAAKEBGDAF.exe RegAsm.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4492 1788 WerFault.exe JEGHJDGIJE.exe 2760 4364 WerFault.exe AAAKEBGDAF.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4176 timeout.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exeMSBuild.exepid process 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe 4564 MSBuild.exe 4564 MSBuild.exe 4564 MSBuild.exe 4564 MSBuild.exe 4564 MSBuild.exe 4564 MSBuild.exe 4564 MSBuild.exe 4564 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exedescription pid process Token: SeDebugPrivilege 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exeMSBuild.exeJEGHJDGIJE.exeAAAKEBGDAF.execmd.exedescription pid process target process PID 1124 wrote to memory of 4616 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4616 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4616 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4564 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4564 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4564 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4564 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4564 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4564 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4564 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4564 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 1124 wrote to memory of 4564 1124 ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe MSBuild.exe PID 4564 wrote to memory of 1788 4564 MSBuild.exe JEGHJDGIJE.exe PID 4564 wrote to memory of 1788 4564 MSBuild.exe JEGHJDGIJE.exe PID 4564 wrote to memory of 1788 4564 MSBuild.exe JEGHJDGIJE.exe PID 1788 wrote to memory of 1940 1788 JEGHJDGIJE.exe RegAsm.exe PID 1788 wrote to memory of 1940 1788 JEGHJDGIJE.exe RegAsm.exe PID 1788 wrote to memory of 1940 1788 JEGHJDGIJE.exe RegAsm.exe PID 1788 wrote to memory of 1940 1788 JEGHJDGIJE.exe RegAsm.exe PID 1788 wrote to memory of 1940 1788 JEGHJDGIJE.exe RegAsm.exe PID 1788 wrote to memory of 1940 1788 JEGHJDGIJE.exe RegAsm.exe PID 1788 wrote to memory of 1940 1788 JEGHJDGIJE.exe RegAsm.exe PID 1788 wrote to memory of 1940 1788 JEGHJDGIJE.exe RegAsm.exe PID 1788 wrote to memory of 1940 1788 JEGHJDGIJE.exe RegAsm.exe PID 4564 wrote to memory of 4364 4564 MSBuild.exe AAAKEBGDAF.exe PID 4564 wrote to memory of 4364 4564 MSBuild.exe AAAKEBGDAF.exe PID 4564 wrote to memory of 4364 4564 MSBuild.exe AAAKEBGDAF.exe PID 4364 wrote to memory of 1888 4364 AAAKEBGDAF.exe RegAsm.exe PID 4364 wrote to memory of 1888 4364 AAAKEBGDAF.exe RegAsm.exe PID 4364 wrote to memory of 1888 4364 AAAKEBGDAF.exe RegAsm.exe PID 4364 wrote to memory of 1888 4364 AAAKEBGDAF.exe RegAsm.exe PID 4364 wrote to memory of 1888 4364 AAAKEBGDAF.exe RegAsm.exe PID 4364 wrote to memory of 1888 4364 AAAKEBGDAF.exe RegAsm.exe PID 4364 wrote to memory of 1888 4364 AAAKEBGDAF.exe RegAsm.exe PID 4364 wrote to memory of 1888 4364 AAAKEBGDAF.exe RegAsm.exe PID 4364 wrote to memory of 1888 4364 AAAKEBGDAF.exe RegAsm.exe PID 4564 wrote to memory of 4124 4564 MSBuild.exe cmd.exe PID 4564 wrote to memory of 4124 4564 MSBuild.exe cmd.exe PID 4564 wrote to memory of 4124 4564 MSBuild.exe cmd.exe PID 4124 wrote to memory of 4176 4124 cmd.exe timeout.exe PID 4124 wrote to memory of 4176 4124 cmd.exe timeout.exe PID 4124 wrote to memory of 4176 4124 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe"C:\Users\Admin\AppData\Local\Temp\ddeeff4e5314374020eec0588d404cbd6ffd20ebf828bc81e9b0816def71232f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\JEGHJDGIJE.exe"C:\ProgramData\JEGHJDGIJE.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 2924⤵
- Program crash
-
C:\ProgramData\AAAKEBGDAF.exe"C:\ProgramData\AAAKEBGDAF.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 3204⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGCGHCBKFCFB" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1788 -ip 17881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4364 -ip 43641⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\AAAKEBGDAF.exeFilesize
937KB
MD5168c5908924803d268d26965c32a5620
SHA19e0e2dc9c7e931c4ee860c32d83711c433f7b1a3
SHA2562fd72d0d0fbc053a53adee5d9ec6cffde3fb5a3c6ba0c0490e24552b264d5449
SHA512749f0e4da8d6fde35b53e769b0b594c2e63835f970eedc54c8c15889863811b5fb296650ae9f5e255bafdd4b942ad3434a60c48e05f1283820c378d30645f1c1
-
C:\ProgramData\JEGHJDGIJE.exeFilesize
516KB
MD50309dd0131150796ea99b30a62194fae
SHA12df6e334708eae810a74b844fd57e18e9fdc34cd
SHA25607c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35
SHA5123d4e5a0718d04fee92d8040880b631107d1e23a6b3bce430d58769179af999c28b99e50c5cd45f283339f7bbb24ffacbf601a5447edb12e28da4517fbfa282e8
-
memory/1124-35-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-2-0x0000000005400000-0x000000000549C000-memory.dmpFilesize
624KB
-
memory/1124-4-0x0000000005660000-0x00000000057BE000-memory.dmpFilesize
1.4MB
-
memory/1124-5-0x00000000054A0000-0x00000000054BC000-memory.dmpFilesize
112KB
-
memory/1124-17-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-15-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-65-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-0-0x000000007462E000-0x000000007462F000-memory.dmpFilesize
4KB
-
memory/1124-1-0x0000000000340000-0x000000000091C000-memory.dmpFilesize
5.9MB
-
memory/1124-70-0x0000000074620000-0x0000000074DD1000-memory.dmpFilesize
7.7MB
-
memory/1124-63-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-61-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-59-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-55-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-54-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-51-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-49-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-47-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-45-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-43-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-41-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-37-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-163-0x0000000074620000-0x0000000074DD1000-memory.dmpFilesize
7.7MB
-
memory/1124-3-0x0000000074620000-0x0000000074DD1000-memory.dmpFilesize
7.7MB
-
memory/1124-25-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-29-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-27-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-31-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-24-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-21-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-13-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-9-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-7-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-57-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-39-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-19-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-11-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-6-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1124-71-0x0000000074620000-0x0000000074DD1000-memory.dmpFilesize
7.7MB
-
memory/1124-33-0x00000000054A0000-0x00000000054B5000-memory.dmpFilesize
84KB
-
memory/1788-144-0x0000000000FB0000-0x0000000000FB1000-memory.dmpFilesize
4KB
-
memory/1940-148-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/4564-86-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/4564-72-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/4564-66-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/4564-68-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/4564-164-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB